[BUG] Verifying that cve-2021-44228 (Apache Log4J / Log4Shell) does not affect openapi-generator

Description

This is a general request for a statement. I am not a java dev but looking through the code dependencies, this project relies on slf4j for logging and not Log4J 2. Am I reading everything correctly?

openapi-generator version

Current Master version 5.3.0

[djbreen7]

Piggy-backing on this as it’s related. Creating a custom generator produces a pom.xml containing this segment indicating that it’s using Maven Surefire w/log4j.

command: openapi-generator-cli meta -n custom-generator -p com.company.custom

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <version>2.12</version>
                <configuration>
                    <systemProperties>
                        <property>
                            <name>loggerPath</name>
                            <value>conf/log4j.properties</value>
                        </property>
                    </systemProperties>
                    <argLine>-Xms512m -Xmx1500m</argLine>
                    <parallel>methods</parallel>
                    <forkMode>pertest</forkMode>
                </configuration>
            </plugin>

I don’t know enough about Java to figure out which version of log4j is used. It looks like it’s only for running tests, so I don’t believe it gets included in the jar file the gets produced when packaged.

Same goal as OP. A statement would be appreciated.

[timbedard]

Scanning with log4j-detect yields a positive result:

Scanning ../OpenAPITools/openapi-generator for vulnerabilities...

Manifest: ../OpenAPITools/openapi-generator/modules/openapi-generator/src/main/resources/scala-gatling/build.gradle
Vulnerable Paths:
|-- org.scala-sbt:zinc_2.12:1.3.5
|  |-- org.scala-sbt:zinc-compile-core_2.12:1.3.5
|  |  |-- org.scala-sbt:util-logging_2.12:1.3.0
|  |  |  |-- org.apache.logging.log4j:log4j-core:2.11.2 Vulnerable

Manifest: ../OpenAPITools/openapi-generator/samples/client/petstore/scala-httpclient/build.gradle
Vulnerable Paths:
|-- org.scala-sbt:zinc_2.12:1.3.5
|  |-- org.scala-sbt:zinc-compile-core_2.12:1.3.5
|  |  |-- org.scala-sbt:util-logging_2.12:1.3.0
|  |  |  |-- org.apache.logging.log4j:log4j-core:2.11.2 Vulnerable

Manifest: ../OpenAPITools/openapi-generator/samples/client/petstore/scala-gatling/build.gradle
Vulnerable Paths:
|-- org.scala-sbt:zinc_2.12:1.3.5
|  |-- org.scala-sbt:zinc-core_2.12:1.3.5
|  |  |-- org.scala-sbt:util-logging_2.12:1.3.0
|  |  |  |-- org.apache.logging.log4j:log4j-core:2.11.2 Vulnerable


One or more of your projects contain the log4j CVE-2021-44228 or CVE-2021-45046 exploit.

Remediation steps:
	* Upgrade to version org.apache.logging.log4j:log4j-core:2.16.0

Learn more about the vulnerability and it's remediation:
https://www.whitesourcesoftware.com/resources/blog/log4j-vulnerability-cve-2021-44228/

©WhiteSource